3a3d6b4ed8b54492292f92a185137e4dd2fd5b4d55b043a9e87fe890eeb25c4f

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_5e0a19ebd51062b65c06d6f3670ba87c_elex_rhadamanthys_stop.exe
Size 243KB
Sample260706-wtfr3aez6m
SHA256 3a3d6b4ed8b54492292f92a185137e4dd2fd5b4d55b043a9e87fe890eeb25c4f
MD5 5e0a19ebd51062b65c06d6f3670ba87c
SHA1 8c9a24de197d9e9fca721e50f1b8cdf08085ea10
SHA512 ac7fbfa319ce8aaf24d719711eda070f0576d25d97a48fe0074039d93d5116b4ee2170df5c67a85036fabd9a7b8da1e9d766e6891dbe0fc91bf37dfbdbaae054
SSDEEP 3072:lCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:ovMsLaOa3lLNngoqRttA7r
TLSH
T1C8345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1924	CP.exe
3308	vpkicavtnl.exe
6044	CP.exe
4440	CP.exe
2272	i_vpkicavtnl.exe
996	usqkidausq.sys
1612	CP.exe
1336	fcxupnhfzx.exe
5648	CP.exe
1676	CP.exe
5632	i_fcxupnhfzx.exe
3384	cxrpnhfcau.sys
5344	CP.exe
6036	uspkicamke.exe
2720	CP.exe
2156	CP.exe
5576	i_uspkicamke.exe
5836	czurmkecxu.sys
3852	CP.exe
5676	upmhfcwrpm.exe
3176	CP.exe
2020	CP.exe
5936	i_upmhfcwrpm.exe
3732	hbztomjhbz.sys
3528	CP.exe
3548	wuomjhbwuo.exe
3384	CP.exe
4488	CP.exe
1056	i_wuomjhbwuo.exe
5700	jgeywtrljh.sys
3860	CP.exe
1420	ljgeywromg.exe
4628	CP.exe
4108	CP.exe
5640	i_ljgeywromg.exe
6076	bwtolgebvt.sys
5888	CP.exe
2272	bytjgbytql.exe
3824	CP.exe
3328	CP.exe
592	i_bytjgbytql.exe
2128	nligayvqnl.sys
5372	CP.exe
2984	sqoidytqoi.exe
5324	CP.exe
2560	CP.exe
1088	i_sqoidytqoi.exe
1160	lfdavsqkid.sys
1148	CP.exe
4244	aysqnifays.exe
3324	CP.exe
2760	CP.exe
3432	i_aysqnifays.exe
1952	caqkicaysq.sys
2200	CP.exe
5956	sqkicaupnh.exe
592	CP.exe
4620	CP.exe
3708	i_sqkicaupnh.exe
5860	uspkicaxsq.sys
5428	CP.exe
3136	xusmcxupnh.exe
2564	CP.exe
1844	CP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_2086788768\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_2089340902\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_2089340902\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_2089340902\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_1701303995\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_2086788768\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_2089340902\office_endpoints_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_658947393\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_1701303995\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpkicavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkicamke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqoidytqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicaupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicaupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsmkfcaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkicamke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytjgbytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusmcxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnkidayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxrpnhfca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_5e0a19ebd51062b65c06d6f3670ba87c_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhfcwrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqoidytqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusmcxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmkhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomjhbzurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgeywromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomjhbzurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkfdyspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkfdyspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhfcwrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgeywromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnkidayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxrpnhfca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpkicavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomjhbwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomjhbwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytjgbytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmkhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsmkfcaxv.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6072	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4208	ipconfig.exe
4816	ipconfig.exe
5536	ipconfig.exe
3284	ipconfig.exe
5068	ipconfig.exe
4112	ipconfig.exe
2444	ipconfig.exe
4468	ipconfig.exe
3340	ipconfig.exe
4588	ipconfig.exe
3880	ipconfig.exe
692	ipconfig.exe
1428	ipconfig.exe
1160	ipconfig.exe
4604	ipconfig.exe
2160	ipconfig.exe
4468	ipconfig.exe
2160	ipconfig.exe
5980	ipconfig.exe
2964	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278351649708246"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{DDE45FF9-273F-4B83-81B3-41F3E5C5C901}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5472	msedge.exe
5472	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2272	i_vpkicavtnl.exe
Token: SeDebugPrivilege	5632	i_fcxupnhfzx.exe
Token: SeDebugPrivilege	5576	i_uspkicamke.exe
Token: SeDebugPrivilege	5936	i_upmhfcwrpm.exe
Token: SeDebugPrivilege	1056	i_wuomjhbwuo.exe
Token: SeDebugPrivilege	5640	i_ljgeywromg.exe
Token: SeDebugPrivilege	592	i_bytjgbytql.exe
Token: SeDebugPrivilege	1088	i_sqoidytqoi.exe
Token: SeDebugPrivilege	3432	i_aysqnifays.exe
Token: SeDebugPrivilege	3708	i_sqkicaupnh.exe
Token: SeDebugPrivilege	3952	i_xusmcxupnh.exe
Token: SeDebugPrivilege	2616	i_upmkhczusm.exe
Token: SeDebugPrivilege	1344	i_uomjhbzurp.exe
Token: SeDebugPrivilege	4640	i_wrojhbztro.exe
Token: SeDebugPrivilege	1412	i_geywqomgey.exe
Token: SeDebugPrivilege	2920	i_ljdbvtnlgd.exe
Token: SeDebugPrivilege	2128	i_vtnkidayvq.exe
Token: SeDebugPrivilege	5948	i_vsnkfdyspn.exe
Token: SeDebugPrivilege	2644	i_avsmkfcaxv.exe
Token: SeDebugPrivilege	2036	i_czxrpnhfca.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 3104	1196	2026-07-06_5e0a19ebd51062b65c06d6f3670ba87c_elex_rhadamanthys_stop.exe	90
PID 3104 wrote to memory of 3848	3104	iexplore.exe	91
PID 3848 wrote to memory of 6012	3848	msedge.exe	92
PID 3848 wrote to memory of 1568	3848	msedge.exe	93
PID 3848 wrote to memory of 6072	3848	msedge.exe	95
PID 3848 wrote to memory of 1568	3848	msedge.exe	93
PID 3848 wrote to memory of 1568	3848	msedge.exe	93
PID 3848 wrote to memory of 6068	3848	msedge.exe	96
PID 3848 wrote to memory of 6068	3848	msedge.exe	96
PID 3848 wrote to memory of 4612	3848	msedge.exe	97
PID 3848 wrote to memory of 4612	3848	msedge.exe	97
PID 3848 wrote to memory of 4612	3848	msedge.exe	97
PID 3848 wrote to memory of 6056	3848	msedge.exe	98
PID 3848 wrote to memory of 6056	3848	msedge.exe	98
PID 3848 wrote to memory of 6056	3848	msedge.exe	98
PID 3848 wrote to memory of 2708	3848	msedge.exe	99
PID 3848 wrote to memory of 1556	3848	msedge.exe	100
PID 3848 wrote to memory of 2708	3848	msedge.exe	99
PID 3848 wrote to memory of 2708	3848	msedge.exe	99
PID 3848 wrote to memory of 1556	3848	msedge.exe	100
PID 3848 wrote to memory of 1556	3848	msedge.exe	100
PID 3848 wrote to memory of 4376	3848	msedge.exe	101
PID 3848 wrote to memory of 4376	3848	msedge.exe	101
PID 1196 wrote to memory of 1924	1196	2026-07-06_5e0a19ebd51062b65c06d6f3670ba87c_elex_rhadamanthys_stop.exe	103
PID 3308 wrote to memory of 6044	3308	vpkicavtnl.exe	106
PID 3848 wrote to memory of 5176	3848	msedge.exe	109
PID 3848 wrote to memory of 2260	3848	msedge.exe	110
PID 3848 wrote to memory of 5176	3848	msedge.exe	109
PID 3848 wrote to memory of 2260	3848	msedge.exe	110
PID 3848 wrote to memory of 4520	3848	msedge.exe	112
PID 3848 wrote to memory of 2736	3848	msedge.exe	115
PID 3848 wrote to memory of 2736	3848	msedge.exe	115
PID 3848 wrote to memory of 5836	3848	msedge.exe	116
PID 3848 wrote to memory of 5836	3848	msedge.exe	116
PID 1196 wrote to memory of 4440	1196	2026-07-06_5e0a19ebd51062b65c06d6f3670ba87c_elex_rhadamanthys_stop.exe	117
PID 1196 wrote to memory of 1612	1196	2026-07-06_5e0a19ebd51062b65c06d6f3670ba87c_elex_rhadamanthys_stop.exe	121
PID 1336 wrote to memory of 5648	1336	fcxupnhfzx.exe	123
PID 1196 wrote to memory of 1676	1196	2026-07-06_5e0a19ebd51062b65c06d6f3670ba87c_elex_rhadamanthys_stop.exe	126
PID 1196 wrote to memory of 5344	1196	2026-07-06_5e0a19ebd51062b65c06d6f3670ba87c_elex_rhadamanthys_stop.exe	130
PID 6036 wrote to memory of 2720	6036	uspkicamke.exe	132
PID 1196 wrote to memory of 2156	1196	2026-07-06_5e0a19ebd51062b65c06d6f3670ba87c_elex_rhadamanthys_stop.exe	135
PID 3848 wrote to memory of 5196	3848	msedge.exe	137
PID 3848 wrote to memory of 5196	3848	msedge.exe	137
PID 3848 wrote to memory of 5196	3848	msedge.exe	137
PID 3848 wrote to memory of 5728	3848	msedge.exe	138
PID 3848 wrote to memory of 5728	3848	msedge.exe	138
PID 3848 wrote to memory of 5728	3848	msedge.exe	138
PID 1196 wrote to memory of 3852	1196	2026-07-06_5e0a19ebd51062b65c06d6f3670ba87c_elex_rhadamanthys_stop.exe	141
PID 5676 wrote to memory of 3176	5676	upmhfcwrpm.exe	143
PID 1196 wrote to memory of 2020	1196	2026-07-06_5e0a19ebd51062b65c06d6f3670ba87c_elex_rhadamanthys_stop.exe	147
PID 3848 wrote to memory of 2448	3848	msedge.exe	149
PID 3848 wrote to memory of 5180	3848	msedge.exe	150
PID 3848 wrote to memory of 5688	3848	msedge.exe	151
PID 1196 wrote to memory of 3528	1196	2026-07-06_5e0a19ebd51062b65c06d6f3670ba87c_elex_rhadamanthys_stop.exe	154
PID 3548 wrote to memory of 3384	3548	wuomjhbwuo.exe	156
PID 1196 wrote to memory of 4488	1196	2026-07-06_5e0a19ebd51062b65c06d6f3670ba87c_elex_rhadamanthys_stop.exe	159
PID 1196 wrote to memory of 3860	1196	2026-07-06_5e0a19ebd51062b65c06d6f3670ba87c_elex_rhadamanthys_stop.exe	163
PID 1420 wrote to memory of 4628	1420	ljgeywromg.exe	165
PID 1196 wrote to memory of 4108	1196	2026-07-06_5e0a19ebd51062b65c06d6f3670ba87c_elex_rhadamanthys_stop.exe	168
PID 1196 wrote to memory of 5888	1196	2026-07-06_5e0a19ebd51062b65c06d6f3670ba87c_elex_rhadamanthys_stop.exe	172
PID 2272 wrote to memory of 3824	2272	bytjgbytql.exe	174
PID 1196 wrote to memory of 3328	1196	2026-07-06_5e0a19ebd51062b65c06d6f3670ba87c_elex_rhadamanthys_stop.exe	177
PID 1196 wrote to memory of 5372	1196	2026-07-06_5e0a19ebd51062b65c06d6f3670ba87c_elex_rhadamanthys_stop.exe	181
PID 2984 wrote to memory of 5324	2984	sqoidytqoi.exe	183

C:\Users\Admin\AppData\Local\Temp\2026-07-06_5e0a19ebd51062b65c06d6f3670ba87c_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_5e0a19ebd51062b65c06d6f3670ba87c_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffd4f07c188,0x7ffd4f07c194,0x7ffd4f07c1a0
      4⤵
      PID:6012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,8813061956121846211,7500292700379093081,262144 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
      4⤵
      PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,10618921520576851134,16602741119731091644,524288 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:11
      4⤵
      System Time Discovery
      PID:6072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,12328315555666534815,757000489373989469,524288 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:13
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,4341822919873287572,14998275976780156224,2097152 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,7281958835012607903,3001362928218920775,2097152 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:6056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,7469511949367281243,2098453609668482083,2097152 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,14825975922842754328,13740805842424528168,2097152 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:9
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,17557340212053243299,1811519291955196739,524288 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,11730545323983800630,12073421387320019939,524288 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,3668697123482087993,5421362451693558621,524288 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
      4⤵
      PID:2260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,2938732685178248316,18362850444191241306,524288 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
      4⤵
      PID:1676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,2938732685178248316,18362850444191241306,524288 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,9971874604251602995,3173986970929548628,524288 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
      4⤵
      PID:2736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,17817734308642786169,7566149957550751939,524288 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
      4⤵
      PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4832,i,14767378294155397492,2471030956977622915,2097152 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:1
      4⤵
      PID:5196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3720,i,11956209188431265025,11251389207523938610,2097152 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,15191622094557743533,18006986626942134660,524288 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
      4⤵
      PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1692,i,8325040770736290287,14547449005531195870,524288 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
      4⤵
      PID:5180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,13421480915958961985,11239762920089513616,524288 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,10885309233776203686,5896952236334056383,524288 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:3732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,16532097848524954596,510402866390227530,524288 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
      4⤵
      PID:824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,10477193658113971959,9080121131171666787,524288 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:14
      4⤵
      PID:1984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,3604153539575517946,12638457012245757616,524288 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:2316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6216,i,2124642379233457422,8165221485687370417,262144 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,16775200532963121809,11734051555827575209,524288 --field-trial-handle=2312,i,6706241898468256468,13114620602378484073,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
      4⤵
      PID:3908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpkicavtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1924
- - C:\Temp\vpkicavtnl.exe
    C:\Temp\vpkicavtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3308
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6044
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpkicavtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4440
- - C:\Temp\i_vpkicavtnl.exe
    C:\Temp\i_vpkicavtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxupnhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1612
- - C:\Temp\fcxupnhfzx.exe
    C:\Temp\fcxupnhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5648
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxupnhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1676
- - C:\Temp\i_fcxupnhfzx.exe
    C:\Temp\i_fcxupnhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uspkicamke.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5344
- - C:\Temp\uspkicamke.exe
    C:\Temp\uspkicamke.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6036
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2720
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uspkicamke.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2156
- - C:\Temp\i_uspkicamke.exe
    C:\Temp\i_uspkicamke.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmhfcwrpm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3852
- - C:\Temp\upmhfcwrpm.exe
    C:\Temp\upmhfcwrpm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5676
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmhfcwrpm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2020
- - C:\Temp\i_upmhfcwrpm.exe
    C:\Temp\i_upmhfcwrpm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomjhbwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3528
- - C:\Temp\wuomjhbwuo.exe
    C:\Temp\wuomjhbwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3548
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomjhbwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4488
- - C:\Temp\i_wuomjhbwuo.exe
    C:\Temp\i_wuomjhbwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljgeywromg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3860
- - C:\Temp\ljgeywromg.exe
    C:\Temp\ljgeywromg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljgeywromg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4108
- - C:\Temp\i_ljgeywromg.exe
    C:\Temp\i_ljgeywromg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytjgbytql.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5888
- - C:\Temp\bytjgbytql.exe
    C:\Temp\bytjgbytql.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2272
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bytjgbytql.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3328
- - C:\Temp\i_bytjgbytql.exe
    C:\Temp\i_bytjgbytql.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqoidytqoi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5372
- - C:\Temp\sqoidytqoi.exe
    C:\Temp\sqoidytqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5324
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqoidytqoi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2560
- - C:\Temp\i_sqoidytqoi.exe
    C:\Temp\i_sqoidytqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqnifays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1148
- - C:\Temp\aysqnifays.exe
    C:\Temp\aysqnifays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4244
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3324
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqnifays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2760
- - C:\Temp\i_aysqnifays.exe
    C:\Temp\i_aysqnifays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicaupnh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2200
- - C:\Temp\sqkicaupnh.exe
    C:\Temp\sqkicaupnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicaupnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4620
- - C:\Temp\i_sqkicaupnh.exe
    C:\Temp\i_sqkicaupnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xusmcxupnh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5428
- - C:\Temp\xusmcxupnh.exe
    C:\Temp\xusmcxupnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xusmcxupnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1844
- - C:\Temp\i_xusmcxupnh.exe
    C:\Temp\i_xusmcxupnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmkhczusm.exe ups_run
  2⤵
  PID:5920
- - C:\Temp\upmkhczusm.exe
    C:\Temp\upmkhczusm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1952
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1804
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmkhczusm.exe ups_ins
  2⤵
  PID:1648
- - C:\Temp\i_upmkhczusm.exe
    C:\Temp\i_upmkhczusm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomjhbzurp.exe ups_run
  2⤵
  PID:5936
- - C:\Temp\uomjhbzurp.exe
    C:\Temp\uomjhbzurp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2044
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomjhbzurp.exe ups_ins
  2⤵
  PID:3396
- - C:\Temp\i_uomjhbzurp.exe
    C:\Temp\i_uomjhbzurp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojhbztro.exe ups_run
  2⤵
  PID:4288
- - C:\Temp\wrojhbztro.exe
    C:\Temp\wrojhbztro.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4268
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:996
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojhbztro.exe ups_ins
  2⤵
  PID:2940
- - C:\Temp\i_wrojhbztro.exe
    C:\Temp\i_wrojhbztro.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywqomgey.exe ups_run
  2⤵
  PID:3876
- - C:\Temp\geywqomgey.exe
    C:\Temp\geywqomgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywqomgey.exe ups_ins
  2⤵
  PID:1748
- - C:\Temp\i_geywqomgey.exe
    C:\Temp\i_geywqomgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtnlgd.exe ups_run
  2⤵
  PID:5984
- - C:\Temp\ljdbvtnlgd.exe
    C:\Temp\ljdbvtnlgd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins
  2⤵
  PID:5624
- - C:\Temp\i_ljdbvtnlgd.exe
    C:\Temp\i_ljdbvtnlgd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnkidayvq.exe ups_run
  2⤵
  PID:3240
- - C:\Temp\vtnkidayvq.exe
    C:\Temp\vtnkidayvq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnkidayvq.exe ups_ins
  2⤵
  PID:5540
- - C:\Temp\i_vtnkidayvq.exe
    C:\Temp\i_vtnkidayvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnkfdyspn.exe ups_run
  2⤵
  PID:5068
- - C:\Temp\vsnkfdyspn.exe
    C:\Temp\vsnkfdyspn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4704
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnkfdyspn.exe ups_ins
  2⤵
  PID:4752
- - C:\Temp\i_vsnkfdyspn.exe
    C:\Temp\i_vsnkfdyspn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avsmkfcaxv.exe ups_run
  2⤵
  PID:3948
- - C:\Temp\avsmkfcaxv.exe
    C:\Temp\avsmkfcaxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5264
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3248
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avsmkfcaxv.exe ups_ins
  2⤵
  PID:4660
- - C:\Temp\i_avsmkfcaxv.exe
    C:\Temp\i_avsmkfcaxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czxrpnhfca.exe ups_run
  2⤵
  PID:1020
- - C:\Temp\czxrpnhfca.exe
    C:\Temp\czxrpnhfca.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2656
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czxrpnhfca.exe ups_ins
  2⤵
  PID:5336
- - C:\Temp\i_czxrpnhfca.exe
    C:\Temp\i_czxrpnhfca.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:748

C:\Temp\usqkidausq.sys
C:\Temp\usqkidausq.sys
1⤵
- Executes dropped EXE
PID:996

C:\Temp\cxrpnhfcau.sys
C:\Temp\cxrpnhfcau.sys
1⤵
- Executes dropped EXE
PID:3384

C:\Temp\czurmkecxu.sys
C:\Temp\czurmkecxu.sys
1⤵
- Executes dropped EXE
PID:5836

C:\Temp\hbztomjhbz.sys
C:\Temp\hbztomjhbz.sys
1⤵
- Executes dropped EXE
PID:3732

C:\Temp\jgeywtrljh.sys
C:\Temp\jgeywtrljh.sys
1⤵
- Executes dropped EXE
PID:5700

C:\Temp\bwtolgebvt.sys
C:\Temp\bwtolgebvt.sys
1⤵
- Executes dropped EXE
PID:6076

C:\Temp\nligayvqnl.sys
C:\Temp\nligayvqnl.sys
1⤵
- Executes dropped EXE
PID:2128

C:\Temp\lfdavsqkid.sys
C:\Temp\lfdavsqkid.sys
1⤵
- Executes dropped EXE
PID:1160

C:\Temp\caqkicaysq.sys
C:\Temp\caqkicaysq.sys
1⤵
- Executes dropped EXE
PID:1952

C:\Temp\uspkicaxsq.sys
C:\Temp\uspkicaxsq.sys
1⤵
- Executes dropped EXE
PID:5860

C:\Temp\upmhecwupm.sys
C:\Temp\upmhecwupm.sys
1⤵
PID:1688

C:\Temp\urpjhezxrp.sys
C:\Temp\urpjhezxrp.sys
1⤵
PID:6080

C:\Temp\ecwuomgezw.sys
C:\Temp\ecwuomgezw.sys
1⤵
PID:5968

C:\Temp\ebztromgdb.sys
C:\Temp\ebztromgdb.sys
1⤵
PID:4604

C:\Temp\ligayvtoig.sys
C:\Temp\ligayvtoig.sys
1⤵
PID:1828

C:\Temp\bvtqlidavt.sys
C:\Temp\bvtqlidavt.sys
1⤵
PID:1628

C:\Temp\davsqnifdx.sys
C:\Temp\davsqnifdx.sys
1⤵
PID:1412

C:\Temp\xvsnlfdxvp.sys
C:\Temp\xvsnlfdxvp.sys
1⤵
PID:1356

C:\Temp\ausmkhfcxu.sys
C:\Temp\ausmkhfcxu.sys
1⤵
PID:1272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxrpnhfcau.sys

Path C:\Temp\cxrpnhfcau.sys
Size 141KB
SHA256 b47add63a20bc9286c62ff14565b6edf75733180ba1ea07746f1fa4b4722413a
MD5 b55a36f784ca2c656a7e61b6bf48e6d6
SHA1 52c9b37c6b1e6f6b69d3a6fc831e7617aeac986d
SHA512 e23ede02f792457993f6ce7d1f76bf4f4ea7e0ef071d1eaf5207bf1b94de4a0d71377c927b23bd4692847a6f02eb0d498848e9fb666bcf12ccffcd86bc32a170
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14EE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurmkecxu.sys

Path C:\Temp\czurmkecxu.sys
Size 141KB
SHA256 2fceb8c6aac35087630212e709740ff18bf378a8fec5882d7455fb6f70d59949
MD5 b53848f98110e0d8bdd905ae0bbff3a4
SHA1 ac7f8dad21e0c8351736d2a5e70b0f1a53bf1a70
SHA512 5342f0cf1e6df43087748478f9a41549b70d18cdebeebf6a6a6575dceab28f8f8c58401a589587de4a0bcff4447b3ad69e65cb08ddaa809a8bd6496736dc32e3
SSDEEP 1536:1a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:1a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D5E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxupnhfzx.exe

Path C:\Temp\fcxupnhfzx.exe
Size 243KB
SHA256 ca07a6ffa3fdb12f47dd899fda984fa438ab0efd58ab2b1620fd582c64f310c8
MD5 afb0bbbbed1eb2cde567870cf20386f1
SHA1 7bd721f3a1e02d121e39790d5cc8cfa6a9ce4970
SHA512 c3484bbff8999bd7b4a7a27624cb1e4f51fe9c0b0f453faae8eb2b85cdf7cf782d6dcc7efde14d955ef5d491372ba0abcb8465e5850d4db9faeb5d9114eddc39
SSDEEP 3072:3CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:SvMsLaOa3lLNngoqRttA7Z
TLSH
T1C5345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbztomjhbz.sys

Path C:\Temp\hbztomjhbz.sys
Size 141KB
SHA256 5297b1ca849d8df6d51cdda5bca9d5ebae8d0604973f4bd9865479c98d6f001f
MD5 cb2a19355196bab4ef5f0b0fd396ec90
SHA1 c5f28b708895143dc07e2822706ac0dc43fc5069
SHA512 c6c94a9b869774ca10cdd4cec024975d45c4c1b98aefa34bb63e8a4f273bcbd6e5f6c2df18f6bae3e342db3ba29e5219f4bc1c06f78cbd19f0c7c2e729f83ae6
SSDEEP 1536:Oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16FE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fcxupnhfzx.exe

Path C:\Temp\i_fcxupnhfzx.exe
Size 243KB
SHA256 9d86483767d0595c8d96d0a557e56bc59625a324591d1ca450bff1d45f2077c5
MD5 04aac10afbf4fd43c8a9d5cbdb88fc66
SHA1 d81b97cbc2eee1b1fcddb9f76782f9d37dfdc154
SHA512 76ac8c5da5ca60dfaf18144583b29b38d5748612d357904b77c9bb41e1d7d14cd2150ec465c6b503a5f5c6a43a80aa75ec55bf05285dc7fd90053a51633bd3c8
SSDEEP 3072:hCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:8vMsLaOa3lLNngoqRttA7r
TLSH
T12D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljgeywromg.exe

Path C:\Temp\i_ljgeywromg.exe
Size 243KB
SHA256 ab17cbdc13c2e5abb226443b0982f44841a1de98b445ff02bebe534d3dfdb4a1
MD5 cbac401840ff8bc6a727ea654fef76b8
SHA1 53118c34b3f8998099caa1f231e9828a37420792
SHA512 ca1a49e7bc3ba5e4270999229583858adc5b946e933cbe963d1295461ded1d8edd1937e4630387311342ffee523c93e052aa665850179f900f180db272b8eff1
SSDEEP 3072:HCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:ivMsLaOa3lLNngoqRttA7x
TLSH
T1B1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_upmhfcwrpm.exe

Path C:\Temp\i_upmhfcwrpm.exe
Size 243KB
SHA256 3d6fbbe3384680b66cdb866d5d13ee16eb4bad2a00ac0b62d7adefe20da85be4
MD5 217694c017f78519ed3e38984f593a0f
SHA1 91dca4654b77bc31b6065b5a98f6d4f3a44f33a2
SHA512 026bbf899e6d7808524bb2d78ef6f698944f1573ea3873e57fc784a8ebdc9fd063049a54cb69424c09d253ed9c831ef5d91eb24078444588c25c6d7764b1bbc4
SSDEEP 3072:bCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:OvMsLaOa3lLNngoqRttA71
TLSH
T18C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uspkicamke.exe

Path C:\Temp\i_uspkicamke.exe
Size 243KB
SHA256 0043cab76a6c72a7bcf1775f863be9f30118bf51222bc67f4a72060064292a37
MD5 4f4d0b43c12f378c53876b1c2a47d332
SHA1 1cadfa4257d6c723eae7af31d2f28463fa0fe77e
SHA512 81d9ffcb983ca5de9fb10f5573d98b81282dcbd3ecc9e8328264e98ca916a0ec5a4a028ab93cea1b47d649c885eba93a9c9241150e520f389ae641cf901d5c1b
SSDEEP 3072:UCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:nvMsLaOa3lLNngoqRttA76
TLSH
T1FD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpkicavtnl.exe

Path C:\Temp\i_vpkicavtnl.exe
Size 243KB
SHA256 16bf32e587750ed7c2106027478699c59eaaba9b561a80f3c2170e954a75121d
MD5 fead02bc385599a607db08a0e4215068
SHA1 862f3b913466cd54e63b45e25d913dac1b9cd2db
SHA512 3c20802a6651ff09d0c52b51017542a0f06c1c7c74b55979f5d8e6a3725e80f76111722ac5a19a38f7fd95defbea3dcd20d262c662aa17b49a904e55aa792a08
SSDEEP 3072:3CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:SvMsLaOa3lLNngoqRttA7R
TLSH
T1A4345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomjhbwuo.exe

Path C:\Temp\i_wuomjhbwuo.exe
Size 243KB
SHA256 2d165f1e23f5a3ec53948fb6c0776133c53932ba0417daa61250e41a4d5d5236
MD5 2e9673469c6906290589e9adc3a22372
SHA1 cb41f7645c665401127f8f2c7a44100d4836c353
SHA512 b73f2dc0c6658289fbfa920343c43b73088dcd48cbd5673b8f5dc08a58028cc34c6426f64fa386a57891a039571d1d4a89637f1ca091a7e0d3f3da7834ac38c4
SSDEEP 3072:rCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:evMsLaOa3lLNngoqRttA7R
TLSH
T1E8345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgeywtrljh.sys

Path C:\Temp\jgeywtrljh.sys
Size 141KB
SHA256 485d6ad66a51f344e8d18ee193aab85d8706bbb5f50c04319fd231a411bb028c
MD5 1cd55472ba7417e7628b3f886302bde8
SHA1 846e52106d7a56f1391cf16a08f5fcf592f6864d
SHA512 1ec1d574091b01a1cf8164afa8880ba002405111306e9896bdbd575357f4c6ea158851cdfc4203a65e785747af0eb22fea048e581ecefd4400fef13c9c016b4d
SSDEEP 1536:sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BDE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljgeywromg.exe

Path C:\Temp\ljgeywromg.exe
Size 243KB
SHA256 b79f758a20b7b10640ce29ff30f61d3402699aa6697fc312b9c89eaff05877d7
MD5 6036977ba7b9da5d55fd521227c41465
SHA1 a68aff5c917bbfc9bdb2092d30145b2167f87c1f
SHA512 999dc091c938fc579ea3817b67baa995daa8cbe66145e69f98510cf4085729ed1a91eda6d7fc174e1c1e7b184fcd1e13ff8fd13d8b584390b35028bdc61942ba
SSDEEP 3072:XCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:yvMsLaOa3lLNngoqRttA79
TLSH
T153345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upmhfcwrpm.exe

Path C:\Temp\upmhfcwrpm.exe
Size 243KB
SHA256 f59a8fa7a9f61b7d473cffcbf5ba84d30ea6a7c1a8f311976e2f9890cdf1df51
MD5 9bfd0a45b327fbaa6a44615f3867a061
SHA1 98a4e0c64cc77caa27ab716b224420d9f69ff924
SHA512 07c7095b575832e004e1b9766df166a248e0bd2a4d3f7b03305e45fbfaedc07964ca83a03a620d97517f3130f8b843526f67212e793b38811590a7a66318f9da
SSDEEP 3072:uCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:hvMsLaOa3lLNngoqRttA7I
TLSH
T1CB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uspkicamke.exe

Path C:\Temp\uspkicamke.exe
Size 243KB
SHA256 2b1aa3ed4ea1ce4b48525419a1fdf8008e62900c2d287d1cd0d02a9daec44e2c
MD5 373ad43fddb9fb4df11316b9260181b4
SHA1 ad322d70fd4026ad92f74139444685aa7408e2ce
SHA512 b80b359de15e0235fa7008d0cc2f25af7814292e31244d414200bc8584301376d4d9f6a75671264c5ce8a6231277e048994f4a4d1828c7a8e86808fd2dc22982
SSDEEP 3072:lCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:ovMsLaOa3lLNngoqRttA7v
TLSH
T1DC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usqkidausq.sys

Path C:\Temp\usqkidausq.sys
Size 141KB
SHA256 34aec465f73beeaf1de34523b3db4b58c38bae07c96628bd553f0bdfd0b3a92b
MD5 be933d7183448d40f988a0d53af882e3
SHA1 8d27567ed27f9be278b7079559eb371a99000e75
SHA512 49003493ebb4b93fb19a8e7d39ac14373b4131335b442d0b0fef166a0515f5ce0f2bfb8d3647d555d7fca259253fc348de3f9dda3eff2639739898ba8f784970
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A7E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpkicavtnl.exe

Path C:\Temp\vpkicavtnl.exe
Size 243KB
SHA256 11985bb0804f638333228f3b5007320a10d0891cfa7b11929f0c2c5c29cd02c4
MD5 a71fee0151f57b44ce5f84a816db7555
SHA1 74f580ad1eb122f38e16ca600be40268c399ce6d
SHA512 729d2aa2069c256c385b39ee3155b2d2588c0555448a71625c3c53df8a50a0fa00f7aac38990da515b5be0d022e8a125fc91f93b04b3a457d29a7bef79fe5b8b
SSDEEP 3072:sCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:PvMsLaOa3lLNngoqRttA7O
TLSH
T1E1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomjhbwuo.exe

Path C:\Temp\wuomjhbwuo.exe
Size 243KB
SHA256 31589cdaa8a5b7ea534f73c70cf6f143f70495b51533947168448852ee489890
MD5 355f0e194d9cbd500329e0a335abf68f
SHA1 fa1fe9d869cfc71f8e1c44b06ab874f9b73a40d9
SHA512 5719556cb0fbab5617c6d34237187f2b7c8717fc86fe92ca195ca4ba9744629e6d3edde3d0d637ed4eed3b4f6f4abd0f9847196a144c35f34c6fe74010d3beaa
SSDEEP 3072:8CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:fvMsLaOa3lLNngoqRttA7S
TLSH
T1A9345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
MD5 714e68787bb5a6d2fd82139f833a5d0d
SHA1 f7a22adc92641d05515b3ae096da910924f11c1a
SHA512 b133f27abfa4ed5bdbd3eaf997e0664f0627537d4882fdaa63c0b1b301219d07f8ba46857db9a196b1210c29ed9f79e6cfd8c688d502b118a21640805665f762
TLSH
T16DD080F43795F605C786617357D0574173750872241647095051D01CCC645DD63DB1EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
MD5 71fa6328268340b183c55defa643c474
SHA1 7c004defb21dc2981b3091495c900e02b34e3a86
SHA512 e5b634d358633981cd343c3da26ee18738fb6c54b2334814637e0a9a45343d14770fed7a09c63d55dd190bf7ef111664ba5872f5d5ce925e6bee783e166c75b7
TLSH
T1D4D080F437A5F505C786617357D0574173650872101647095151D02CCC645DD63DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9ead4d9d0ceae675079afcf9c3677cff2e1c58cf3d8c4de08035b6660b37957e
MD5 1b477366d45766654642259aae4ff8b4
SHA1 a0c8dc23815950fecf16df85e2fe9120e75ef325
SHA512 e61dff50edf1eb3b55039dc4dc4d6e31a6351176df3d72fb0a431e12b17e2d59347833547a6a4c46b3979abf4031e4761632a32e82aeb66414c7a8841be2f1db
TLSH
T1F9611BCD056E0A1FC32604B923EAD0BBFF70CC9617836E16006697794D0A37B724E830
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 86c9e41acec2c8b4727690128da050a4e7f5ce5179d7725ab8dce4ed54a8e270
MD5 357e321d21a131a9805deeeb6205f131
SHA1 03685cfa03f1032ba12bbba6df8ee307aae18f8d
SHA512 379b3fe3b9aee9d8ffeb96e779738b4c4eb1295e486d2a3dbcc41e8dc01cef7e5b90154e53bc281bee887cdc306905d56fe0b5fba265be0596539c744ebb4ce7
TLSH
T1AD41BEF7C3E8853D8A0156F4BB142E2BCE2D0914832C7D5AC5E49F1B93E2471D28099E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3ca23597904a909880da52011116acaeefc05cafe85a1a19a0ec05e9df8da620
MD5 8334c8af175e90cc7757ce887d2c62a1
SHA1 5bdcf689428c7288c5a76b0b56e5dac78644b3b7
SHA512 12c7eb04a7637b3a306ace77c159ba01d313f6cb38686c4edaf9afc41bb9a3406c0d2a2f5535f2a104cbffcab64df07c78ab3737f943d5fc7221f537f5cf5bb1
SSDEEP 192:sxRv/yM/jK1Ml8wc06/fkszUdqZbUGyFzoA8p9a/g6+WNCFy/YyyJMG7IgDg8J:sxRv7CD/fkszm8bUGyok/5N/yb/
TLSH
T1DC62D916AA24593B8CDBD21DFA517F93D6F91473A2511F48AAFCCA0C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 32a78422d3d53d8aeeb8231e8e3a8cc9bc2ce3f4e843ddda95cd0c0479818207
MD5 e1f395fb12e56aebe28fe6ede380c549
SHA1 ef7cc03301369033a086f4e9aee3c207783ed850
SHA512 35ddbaa87acdb1f3a161a2c261786ab8e9efe04efe60048d3040344514c3a7fd6e69c008b6bfebfd3c85fe502d763cdeb90c1fadad545fc996517f74fdbfa09a
SSDEEP 192:sxRw/yM/jK1Ml8wc06/fks5UdqZbUGyRzoA8pi/g6+WNIYyBJMG7IgtJ:sxRw5CD/fks5+8bUGyMi/5IFb3
TLSH
T11552D9156A34593B8CDBD21DFA517F53D6F91573A2901E08AAFCCA1C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 46feda3c613b373c93cc00d3cd3a6b009ccea46ac54724d74e9c09fbd39f8432
MD5 fea999e4bcf9b8b79f46bc94360cf0bd
SHA1 1ffb9b2bf86513dea302d3ced0eb838c447cff53
SHA512 f4310d472854d36afb437688ae3cafabc4d2ac803bb2873c87ff8e23e98373342a78c1c67b799e8c3e48dc94ce843d0d068bd2b01db8661b6eedb26fa4efa8df
SSDEEP 192:sxRv/yM/jK1Ml8wc06/fkszUdqZbUGyRzoA8pi/g6+WNIYyBJMG7IgDgaJ:sxRv5CD/fksz+8bUGyMi/5IFbx
TLSH
T18652DA15AA3459378CDBD21DFA517F53D6F91573A2501F08A9FC8A1C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 344c040b913988f88561c8a6411a0f05949b79afcfbf9efdba73b07ca7e769fb
MD5 a0eba24ee73cc0ee454989bc8c84b0e2
SHA1 7d75161246a23ff1033cf77289a6fbfdce78a123
SHA512 28ece9c3eb417897117541e94aa5ab1ad21e4a22cd76a43203c9abc13a978ad644d1467eaa6712fbade8960972a62c4e20e805d20a05fdcfd0a94791ba5f3463
SSDEEP 192:sxRv/yM/jK1Ml8UQ+c06/fkszUdqZbUGyFzoA8pra/g6+WNCFy/YyyJMG7IgDg8J:sxRv7q9D/fkszm8bUGyo2/5N/yb/
TLSH
T13B62D916AA34593B8CDBD21DFA517F93D6F91472A2541F48AAFCCA0C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 7d18c7ac03831af4fbf0cff7bb1d486883b1747ee6dfbb88c0000a62809ccb2b
MD5 c464a0318cbf84e67d2b62c582738c4d
SHA1 2dd6a66db3224bbe7208a052039306bf54cbf3ed
SHA512 9943f92c61a1a7f42e1d7687ad6f7b858d47a00a41bfa9085c70583168864e82f2a0a7475c5a27b59c452d7b027d5be38e9f18a930203ae497c206a71d0130ad
SSDEEP 768:AIox/O7pLuL7p0WguMfnA8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4xfcci9ro5klZU:AIox/OE7p0WguMfnAu1jaTxfXi25kE
TLSH
T19EE2EB3B680CCB7F4F8049DCEC29BE9A6DA801CF96D8CD5447FA841C03C66EB56165DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 87fa93c65fcb22acf9bf7f4a99897fe2858c2054672125ad9c717d819c276e3c
MD5 34486110a014e78f17456314858c49a2
SHA1 08d57b09c37bf38f12e1d87ebdda03037d5a9a80
SHA512 3f3ae95871e0c24146bc5fd78db057be6bdc31a85b40bbab4c9b55b6e31e5cba4d12dcd6060f6405c36b0a673c21260f12508bd3469a8c26bf5cd501d8407a9a
SSDEEP 96:KgZiKKkyul+Km8uXAlhXVFJWx+EgpJK4AgnJcPnmZl6H9KD3tHc:I9xNXAlhXVFkx+VpjAgnWPnmZl6H9KDC
TLSH
T1F1915E01B67B67443C7D791D81A8981B968270A230C7A92B3BA851F62F27E005FFD9CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ce94a5a-44ef-43bf-bdc3-3abfeb1ee858.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3ce94a5a-44ef-43bf-bdc3-3abfeb1ee858.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 234a752ed72cf5f6a417b01a8027a05b23d986c3ef9baf014900e85347146557
MD5 01ecce0e528d78b787e975e964a289aa
SHA1 046d9123c4dcdc9a21d6be47be8edd308b6a183d
SHA512 d1eee7b224016bf3c2cbcfa40a152dc3e1e7340d3ac65cb27eebabe60b0f4b1b0f6cb74f12b2f9b5000519e1990df94ee0d0a31b5d8e492bb1e3ec159a63a185
SSDEEP 768:Xj+9P3K8etQOJI1PyMR/hUAFjQIMyOV3N5E9EPb9MD2:a9P3XhNFUIpONNmib+D2
TLSH
T170F2AE31B896DE638CEBD6C9771A7287BFE001B784C51E44D9EEAB0D068329D0757C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c63cea51d5db72ef676c7b1aa8a942d22ad653b58e480cea13d095ed7c6d3f6d
MD5 0c7b30f1905347f1bc334218bfe588c8
SHA1 ace436a5c5768a562aa94d35ee6216b7f48399fd
SHA512 d74f1daac120280c608d4a4db663e5c04b312fb6d7fb82317ba563f0209f8e063a5e132c0ee107503f0ba0d2a180ca81a5596c6f2259542c255fe388dc74d6cf
SSDEEP 768:9rv+4UNbdF395fQOJI1PW/hUAFjQIMyOV3N5E9Mxo+8r0mL:9bsbf3VhNFUIpONNmnDrv
TLSH
T19B03BF32A8A5DAB39CE7D6C5770A72437FF441A395C50B84C9DE2B0D824B5DE231BC62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 3f0eaea4e56b0adb495846b029da295bad390e126bfa8dba631b5be0d8f34c78
MD5 54103280ba67b1dbd0a7616d05e6d63f
SHA1 1703797dc68916a7250fa026ece1268c38841754
SHA512 f844e25d24735aeb477b569980959a78dbc72a414e4dd9c46dddfa7fbd5466c945d33edaf429ac96bcb0f827dee296832d8cb884bf2038e358f59c17989fe6fb
SSDEEP 768:Zrv+4UNbd93J8otQOJI1PyMs/hUAFjQIMyOV3N5E9EP+8r0mz:ZbsbT3/hNFUIpONNmiDr/
TLSH
T11513BF31E9A9DE635DFBE6C8760A72837FF410B344C14A84C9DA6B0D45472DE271BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 36b77d3510aee5cb1ae13cc4ad176552f9c8ec875ddbc387dafb40daf2b74744
MD5 fd43ec2fadf1bfc657d4120d38eaa054
SHA1 a0088adadbe781dd28fc317f45ac5fd919ea1857
SHA512 17dc677e05badbcc3d341d80cc62f97f149ff3cbe047ba4d69ab8354b5d9e51cd12fd3b67b5b6023eda560873de26ecb0ab4c22c5d89605b57c2852af8ae4e53
SSDEEP 768:1rv+4UNbd93J8etQOJI1PyMR/hUAFjQIMyOV3N5E9EP+8r0mz:1bsbT3ihNFUIpONNmiDr/
TLSH
T16313BF31A9A9DE635DFBE688760A72837FF410A344C14A84C9EA5B0D454B2DE271BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3092bcb-11f0-44a9-9a6d-e4c8c6d65b75.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a3092bcb-11f0-44a9-9a6d-e4c8c6d65b75.tmp
Size 43KB
SHA256 063d1bc20c53a775fe216a2caf5b4ce08e363afee2aa2519f1269c448ef2093f
MD5 018a9b98ecbb5090eb5ef0ed0e408180
SHA1 5d06aeb8b32a5acf9d054148e48be77ebec49d07
SHA512 976b73da147204b1283c7b17581405d002aaddf87af8f1d2f8177dfc163ce773052f12413d9f64febe38c7ecdaabe73f928ba7d224f53bfe33ecf742b971268a
SSDEEP 768:LF1j+9v3ewgl8+YrOJI1PyMT/hUAFjQIMyOV3N5E9EPb9MD2:K9v3rhNFUIpONNmib+D2
TLSH
T1981328F298D3DA76D8AE8787673D6D46AEBCC16374845984B7D95E0CCC821BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3848_690312439\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/996-189-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1160-341-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1272-505-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1356-501-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1412-476-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1628-471-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1688-395-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1828-450-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1828-473-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1952-345-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1952-375-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2128-325-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3384-236-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3384-269-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3732-313-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3732-286-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4604-439-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5700-307-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5836-263-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5860-374-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5968-419-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6076-319-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6076-327-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6080-415-0x0000000000010000-0x0000000000083000-memory.dmp

Download